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DETAILED ACTION 
EXAMINER'S AMENDMENT 

1. An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Mr. Timothy Bechen on 19 November 2007. 

The application has been amended as follows: 
1. (Currently Amended) A method for analyzing a potential cause of a change in a 
service, wherein service quality of the service is monitored, usage of the service is 
measured, and service events are detected, the method comprising: 

determining a service change time window based at least in part upon a change 
in service quality between a first working state and a second, non-working state, and 
upon a change in service usage amount, the service change time window 
encompassing at least part of a service outage; 

retrieving data representing a plurality of detected events and a-corresponding 
times in which the events occurred; 
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computing a probability for each of the detected events that each of the detected 
events caused the service change based at least in part on a correlation between the 
event time and the service change time window; 

determining whether one or more other events of a type identical to one of the 
detected events occurred: 

and wherein computing the probability comprises computing the probability using 
at least in part a false occurrence weighting function which decreases the probability of 
the detected event as the cause of the service change for instances in which the 
detected event occurred outside the service change time window. 

2. (Original) The method of claim 1 , wherein determining the service change time 
window comprises determining a service failure time window based upon the change in 
service quality and narrowing the service failure time window to the service change time 
window based upon the service usage amount measured during that service failure time 
window. 

3. (Original) The method of claim 2, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure 
time window as bounded by a polled point of the first working state and a polled point of 
the second, non-working state. 

4. (Original) The method of claim 1, wherein computing the probability comprises 
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computing the probability using at least in part a time weighting function which 
decreases exponentially with the distance between the event time and the service 
change time window. 

5. (Cancelled) 

6. (Previously Amended) The method of claim 1, comprising storing historical data 
associating occurrences of prior events with prior service changes, and wherein 
computing the probability that one of the detected events caused the service change 
comprises computing the probability based at least in part on the historical data. 

7. (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events occurred within prior service change 
time windows, and wherein computing the probability that the detected event caused 
the service change comprises using at least in part a positive occurrence weighting 
function which increases the probability of the detected event as the cause of the 
service change based on instances in the historical data in which a prior event of a type 
identical to the detected event occurred within a prior service change time window. 

8. (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events were identified as having caused prior 
service changes, and wherein computing the probability that the detected event caused 
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the service change comprises using at least in part a historical weighting function which 
increases the probability of the detected event as the cause of the service change 
based on instances in the historical data in which a prior event of a type identical to the 
detected event was identified as having caused a prior service change. 

9. (Cancelled) 

10. (Currently Amended) The method of claim 1, wherein computing probabilities 
comprises computing the probabilities such that the total of all computed probabilities is 
1. 

11. (Currently Amended) The method of claim 1, wherein the service comprises service 
over a communication network and wherein the detected events include a network 
event. 

12. (Currently Amended) The method of claim 1 , wherein the service comprises service 
provided by an application program and wherein the detected events include comprises 
an application program event. 

13. (Original) The method of claim 1, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service quality 
from the first working state to the second, non-working state. 
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14 (Original) The method of claim 1, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service quality 
from the second, non-working state to the first, working state. 

15 (Original) The method of claim 1, wherein determining the service change time 
window comprises detecting a change in service quality by detecting a step change in 
measured usage. 

16 (Currently Amended) A method for analyzing potential causes of a service change, 
the method comprising: determining a service change time window encompassing a 
change of service between a first working state and a service outage, the service 
change being determined at least in part based on measured service usage levels; 
detecting occurrences of a set of events; retrieving data representing the plurality of 
detected events and corresponding times in which the events occurred, wherein the set 
of events are within a given time prior to and during the service change time window, 
each occurrence of an event being associated with a time at which the event occurred; 
computing a probability distribution for the set of events, which probability distribution 
determines for each event in the set the probability that the detected event caused the 
service change, the probability distribution being based at least in part on relations 
between the time of each event occurrence and the service change time window; and 
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wherein computing the probability includes using two or more second functions selected 
from the group consisting of: a time weighting function which decreases exponentially 
the probability of a given event as the cause of the service change with the distance 
between the given event time and the service change time window: a false occurrence 
weighting function which decreases the probability of a given event as the cause of the 
service change for instances in which events of the same type as the given event 
occurred outside the service change time window: a positive occurrence weighting 
function which increases the probability of a given event as the cause of the service 
change based on instances stored in a historical database in which events of the same 
type as the given event occurred within a prior service change time window: and a 
historical weighting function which increases the probability of a given event as the 
cause of the service change based on instances in the historical database in which 
events of the same type as the given event were identified as having caused a prior 
service outage. 

17. (Original) The method of claim 16, wherein computing the probability distribution for 
the set of events comprises computing the probability distribution using a first weighting 
function which is the product of two or more second weighting functions. 



18. (Cancelled) 
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19. (Original) The method of claim 16, wherein the step of computing the probability 
distribution comprises using a first weighting function which is the product of the time 
weighting function, false occurrence weighting function, positive occurrence weighting 
function, and user weighting function. 

20. (Original) The method of claim 16, comprising monitoring service quality, and 
wherein determining the service change time window comprises determining a service 
failure time window based upon a change in monitored service quality and narrowing 
the service failure time window to the service change time window based upon the 
service usage amount measured during that service failure time window. 

21. (Original) The method of claim 20, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure 
tjme window as bounded by a polled point of the first working state and a polled point of 
the second, non-working state. 

22. (Original) The method of claim 16, comprising computing the probability distribution 
such that the total of all probabilities in the distribution is 1 . 
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23. (Original) The method of claim 16, wherein the service comprises service over a 
communication network and wherein the detected events comprise network events. 

24. (Original) The method of claim 16, wherein the service comprises service provided 
by an application program and wherein the detected events comprise application 
program events, 

25. (Original) The method of claim 16, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service from the 
first working state to the second, non-working state. 

26. (Original) The method of claim 16, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service from the 
second, non-working state to the first, working state. 

27. (Previously Presented) The method of claim 16, wherein determining the service 
change time window comprises detecting a step change in measured usage. 

28. (Currently Amended) A network monitoring system comprising: a service monitor for 
monitoring quality of service on the network; a usage meter for measuring usage of the 
network; an event detector for detecting a plurality of network events and corresponding 
times at which the network events occur; and 
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a probable cause engine, coupled to receive data from the service monitor, usage 
meter, and the event detector, the probable cause engine including a processing device 
that, in response to executable instructions, is operative to: set setting a service change 
time window based upon data received from the service monitor or usage meter, the 
service change time window encompassing at least part of an occurrence of a service 
outage in the network; determine determining which of the network events detected by 
the event detector is the most likely cause of a service change including computing a 
probability for each of the detected events that each of the detected events caused the 
service change based at least in part on a correlation between the event time and 
service change time window; determining whether one or more other events of a type 
identical to one of the detected events occurred; and wherein computing the probability 
comprises computing the probability using at least in part a false occurrence weighting 
function which decreases the probability of the detected event as the cause of the 
service change for instances in which the detected event occurred outside the service 
change time window. 

29. (Currently Amended) A computer readable medium storing program code for, when 
executed, causing a computer to perform a method for analyzing a potential cause of a 

< 

an change in a service, wherein service quality of the service is monitored, usage 
amount of the service is measured, and service events are detected, the method 
comprising: determining a service change time window based at least in part upon a 
change in service quality between a first working state and a second, non-working state, 
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and upon a change in service usage amount, the service change time window 
encompassing at least part of a service outage; retrieving data representing a plurality 
of detected events and a-corresponding times in which the events occurred; computing 
a probability for each of the detected events that each of the detected events caused 
the service change based at least in part on a correlation between the event time and 
the service change time window; determining whether one or more other events of a 
type identical to one of the detected events occurred; and wherein computing the 
probability comprises computing the probability using at least in part a false occurrence 
weighting function which decreases the probability of the detected event as the cause of 
the service change for instances in which the detected event occurred outside the 
service change time window. 

30. -61. (Cancelled) 

62. (Currently amended) Computer readable media comprising program code that, 
when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, 
the method comprising: determining a service change time window encompassing a 
change of service between a first working state and a service outage, the service 
change being determined at least in. part based on measured service Usage levels; 
detecting occurrences of a set of events; retrieving data representing the plurality of 
detected events and corresponding times in which the events occurred, wherein the set 
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of events are within a given time prior to and during the service change time window, . 
each occurrence of an event being associated with a time at which the event occurred; 
computing a probability distribution for the set of events, which probability distribution 
determines for each event in the set the probability that the detected event caused the 
service change, the probability distribution being based at least in part on relations 
between the time of each event occurrence and the service change window; wherein 
computing the probability includes using two or more second functions selected from 
the group consisting of: a time weighting function which decreases the probability of a 
given event as the cause of the service change with the distance between the given 
event time and the service change time window: a false occurrence weighting function 
which decreases the probability of a given event as the cause of the service change for 
instances in which events of the same type as the given event occurred outside the 
service change time window: a positive occurrence weighting function which increatses 
the probability of a given event as the cause of the service change based on instances 
stored in a historical database in which events of the same type as the given event 
occurred within a prior service change time window: and a historical weighting function 
which increases the probability of a given event as the cause of the service change 
based on instances in the historical database in which events of the same type as the 
given event were identified as having caused a prior service outage. 

63. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the 



Application/Control Number: 09/724,025 Page 13 

Art Unit: 3628 

programmable microprocessor to execute a method for analyzing potential cause of a 
service change; wherein computing the probability distribution for the set of event 
comprises computing the probability distribution using a first weighting function which is 
the product of two or more second weighting functions. 

64. (Cancelled) 

65. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the 
programmable microprocessor to execute a method for analyzing potential cause of a 
service change, the method comprising monitoring service quality, an wherein 
determining the service change time window comprises determining a service failure 
time window based upon a change in monitored service quality and narrowing the 
service failure time window to the service change time window based upon the service 
usage amount measured during the service failure time window. 

.66. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the 
programmable microprocessor to execute a method for analyzing potential cause of a 
service change, the method comprising computing the probability distribution such that 
the total of all probabilities in the distribution is 1 . 
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67. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the 
programmable microprocessor to execute a method for analyzing potential cause of a 
service change, wherein the service comprises service over a communication network 
and wherein the detected events comprise network events. 

68. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the 
programmable microprocessor to execute a method for analyzing potential cause of a 
service change, wherein the service comprises service provided by an application 
program and wherein the detected events comprise application program events. 

69. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the 
programmable microprocessor to execute a method for analyzing potential cause of a 
service change, wherein the service change is a service outage, comprising determining 
the service change time window as a change in service from the first working state to 
the second, non-working state. 



70. - 77. (Cancelled) 
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Allowable Subject Matter 

2. The following is an examiner's statement of reasons for allowance: see Office Action 
dated 30 May 2007. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to SHANNON S. SALIARD whose telephone number is 
(571)272-5587. The examiner can normally be reached on Monday - Friday, 8:00 am - 
4:30 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John W. Hayes can be reached on 571-272-6708. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300: 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

Please address mail to be delivered by the United States Postal Service (USPS) 
as follows: 

Commissioner of Patents and Trademarks 
Washington, D.C. 20231 

Or faxed to: 

(571) 273-5587 [Informal/ Draft Communications, labeled 

"PROPOSED" or "DRAFT"] 
Hand delivered responses should be brought to the Customer Service Window, 
Randolph Building, 401 Dulany Street, Alexandria, VA 22314 



Shannon S Saliard 
Examiner 
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